3 ms·

> • SCAN the SGQR and check the merchant name > • PAY the correct amount Visual verification by users is bad news. Malicious users may register with letters t

> • SCAN the SGQR and check the merchant name > • PAY the correct amount Visual verification by users is bad news. Malicious users may register with letters that have similar or identical glyphs to that of a real merchant. E.g. eBay vs еВау. Leaving aside typos, multiple possible transliterations, punctuation; overall it's a shitstream of headaches and possible attacks.

freddie_mercury 8y ago
Singapore has been using QR codes for a long time, with just one wallet provider having over 1.2 million monthly QR code transactions. Can you point to news articles of people being scammed via the methods you describe?
- Uberphallus 8y ago
  https://www.channelnewsasia.com/news/technology/scan-or-scam-why-you-should-think-before-you-use-a-qr-code-9506310 https://www.channelnewsasia.com/news/technology/scan-or-scam...
  - freddie_mercury 8y ago
    "In response to queries, the Cyber Security Agency of Singapore (CSA) said SingCERT has not received reports of malicious QR codes in Singapore." So not a single case in tens of millions transactions. Seems like no point in posting since it isn't actually a problem in practice. It is also clear that it is only really a problem for the vendor, who doesn't receive the money, not the customer, who already has the service/product.
    - Uberphallus 8y ago
      > So not a single case in tens of millions transactions Citation needed. And I doubt it given that it's working since Monday. Also to take into account that Singapore is basically a city, so as a sample it's not very representative.
      - freddie_mercury 8y ago
        Singapore has been using QR codes for years, not just since Monday.
        Uberphallus 8y ago
        The one we're talking about is since Monday. There are others in place, displayed in tablets/screens, dynamically generated and cryptographically secure. This is printed, like the fraud-ridden Chinese codes, so it's vulnerable to the "sticker attack".
- cdf 8y ago
  i'm from Singapore, what QR code transaction are you talking about? Never heard of it. Are you confusing us with China/WeChat?
tinus_hn 8y ago
And then the users walks up to the nearest ATM, inserts his card and enters his code.

freddie_mercury 8y ago

Singapore has been using QR codes for a long time, with just one wallet provider having over 1.2 million monthly QR code transactions. Can you point to news articles of people being scammed via the methods you describe?

Uberphallus 8y ago
https://www.channelnewsasia.com/news/technology/scan-or-scam-why-you-should-think-before-you-use-a-qr-code-9506310 https://www.channelnewsasia.com/news/technology/scan-or-scam...
- freddie_mercury 8y ago
  "In response to queries, the Cyber Security Agency of Singapore (CSA) said SingCERT has not received reports of malicious QR codes in Singapore." So not a single case in tens of millions transactions. Seems like no point in posting since it isn't actually a problem in practice. It is also clear that it is only really a problem for the vendor, who doesn't receive the money, not the customer, who already has the service/product.
  - Uberphallus 8y ago
    > So not a single case in tens of millions transactions Citation needed. And I doubt it given that it's working since Monday. Also to take into account that Singapore is basically a city, so as a sample it's not very representative.
    - freddie_mercury 8y ago
      Singapore has been using QR codes for years, not just since Monday.
      - Uberphallus 8y ago
        The one we're talking about is since Monday. There are others in place, displayed in tablets/screens, dynamically generated and cryptographically secure. This is printed, like the fraud-ridden Chinese codes, so it's vulnerable to the "sticker attack".
cdf 8y ago
i'm from Singapore, what QR code transaction are you talking about? Never heard of it. Are you confusing us with China/WeChat?

tinus_hn 8y ago

And then the users walks up to the nearest ATM, inserts his card and enters his code.